karakeep-note-capture

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:45 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Karakeep note-capture helper, but users should be aware it sends authenticated requests to a local HTTP endpoint.

Install only if this Karakeep instance is yours and reachable on a trusted network. Prefer serving Karakeep over HTTPS or a trusted private tunnel, keep the token file protected, and avoid saving credentials, private messages, or other sensitive material as notes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31

Finding

Authenticated Karakeep API Traffic Uses Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–35
Vulnerability Type: Cleartext transmission of authenticated API traffic
Risk Level: Medium

Vulnerable Code

markdown

Defaults:

- Karakeep base URL: `http://192.168.0.64:3000`
- Secret token file: `/root/.openclaw/secrets/karakeep-openclaw-api-token`
- List: `OpenClaw Notes`
- Default tags: `openclaw`, `kevin`

Technical Analysis

The documented Karakeep endpoint uses unencrypted HTTP while the helper authenticates using a secret API token. Without TLS, HTTP requests and responses lack transport confidentiality and server authentication. A party capable of observing or modifying traffic between the Agent host and 192.168.0.64:3000 may intercept note contents and authentication material or tamper with requests and responses.

The token itself is not hardcoded in the project and is stored in a separate secret file, which is a positive control. However, secure storage at rest does not protect the token while it is transmitted over plaintext HTTP.

Attack Path

1. The Agent invokes /root/.openclaw/workspace/bin/karakeep-note as instructed by the Skill.
2. The helper connects to http://192.168.0.64:3000 and submits an authenticated note-creation request.
3. An attacker with visibility or control over the local network path captures or alters the plaintext HTTP exchange.
4. If the API token is transmitted in the request, the attacker extracts and reuses it.
5. The attacker exercises the token's documented bookmark, list, and tag read-write permissions against Karakeep.

Impact Assessment

A successful attacker may read or modify resources available to the openclaw-notes token, including bookmarks, lists, and tags. Submitted note content may be disclosed or modified in transit. The impact is limited by the token's Karakeep scope, but the documented scope includes read-write access. Network-path access is required for ex ...[truncated 11 chars]

Remediation

View remediation

Remediation Suggestions

• Serve Karakeep over HTTPS and replace the plaintext URL with an https:// endpoint.
• Require normal certificate and hostname validation; do not disable TLS verification.
• If Karakeep cannot provide TLS directly, place it behind a properly configured TLS reverse proxy.
• Restrict network access to the Karakeep service through firewall rules or a trusted private overlay network.
• Reduce the API token to the minimum permissions necessary, preferably create-only access if supported.
• Rotate the existing token after encrypted transport is deployed because prior plaintext use may have exposed it.
• Preserve the existing secret-file protection and verify that the file remains owned by the intended account with mode 0600.
• Ensure the helper never logs authentication headers, tokens, or sensitive note bodies.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep